garbage input crashes doozerd

[beaufour]

Steps to Reproduce

$ ./doozerd &
$ echo foo | nc localhost 8046

Result

doozerd crashes here:

throw: runtime: out of memory
goroutine 26 [running]:
github.com/ha/doozerd/server.(*conn).read(0xf8400dfa00, 0xf840142008, 0xf800000000, 0x7f8ef9422f70, 0x51d0ee, ...)
    /home/ubuntu/doozer_compile/src/github.com/ha/doozerd/server/conn.go:50 +0x220
github.com/ha/doozerd/server.(*conn).serve(0xf8400dfa00, 0x67cb94)
    /home/ubuntu/doozer_compile/src/github.com/ha/doozerd/server/conn.go:31 +0x4a
github.com/ha/doozerd/server.serve(0xf84007a3c0, 0xf84008c590, 0xf840000690, 0xf8400d5300, 0xf8400bc6a0, ...)
    /home/ubuntu/doozer_compile/src/github.com/ha/doozerd/server/server.go:52 +0x191
created by github.com/ha/doozerd/server.ListenAndServe
    /home/ubuntu/doozer_compile/src/github.com/ha/doozerd/server/server.go:35 +0x342

The reason is that this:

err := binary.Read(c.c, binary.BigEndian, &size)
buf := make([]byte, size)

returns a very big size from Read in this case (hence the oom)

[bketelsen]

Is this still a valid issue?

[mreiferson]

yes, but there are a variety of ways you could imagine resolving it.

for example, the daemon can (somewhat) protect itself if we bound the size of a doozer command (in bytes)